Q: Can I use my parents' insurance for therapy without them finding out?

A: Partly automatic, and the part that is not automatic is the part people assume is. California law puts "all health care services related to mental or behavioral health" at the top of its list of sensitive services, and says a plan shall direct every communication about them to the individual receiving the care — the explanation of benefits, bills and collection attempts, denial notices, requests for more information, the provider's name and address, anything containing your health information.¹ It may not disclose any of it to the policyholder without your express written authorization.²

But read the next sentence of the statute, because it is the one that decides whether an envelope lands on the kitchen table. If you have not designated an alternative address, email or phone number, the plan sends those communications in your name — to the address or telephone number already on file.³ On a family policy, that is usually the family's address. The addressee changes; the destination does not. So the automatic protection stops the plan telling your parents about your care, and it does not, by itself, stop the envelope arriving at their house.

The step that actually moves the mail is a confidential communication request, and it takes one phone call. Any subscriber or enrollee can make one. The plan must accommodate it in the form and format you ask for, if that is readily producible, or at an alternative location, and must implement it within 7 calendar days of an electronic or telephone request (an insurer must also honour that deadline for a request made through its website), or 14 calendar days by first-class mail.⁴ It may require the request in writing or electronically, and it stays in force until you revoke or replace it.⁴ The statutes set out no requirement that you explain why; the conditions either one authorises are the form the request comes in and whether what you ask for is readily producible. An insurance company (not an HMO) that ignores the deadline is exposed to Insurance Commissioner penalties of up to $5,000 a violation, and $10,000 where the violation is wilful.⁵

Who counts as a "protected individual." Any adult covered by the subscriber's plan — so a 22-year-old on a parent's policy qualifies simply by being an adult — and any minor who can lawfully consent to the care without a parent, which for outpatient therapy in California means 12 and over, subject to the therapist's maturity finding.⁶ The one group the definition expressly excludes is a person who lacks the capacity to give informed consent for health care under Probate Code §813.⁶ How minor consent works →

The plan cannot make you go through your parent to use it. It may not require you to get the policyholder's authorization either to receive sensitive services or to submit a claim for them, provided you have the right to consent to the care yourself, and it may not condition your enrolment or coverage on giving up any of this.⁷

Three places this stops, stated plainly.

  1. A self-funded employer plan is neither a "health care service plan" nor a "health insurer," which is what these two statutes govern. Nearly two-thirds of workers with employer coverage are in one.¹⁰ There you are relying on the federal rule instead, and under it a health plan need only accommodate the request if you state that disclosure could endanger you.⁸ How to tell whether your plan is self-funded →
  2. Your therapist can still talk to the plan about who is paying. The law expressly lets a provider make arrangements with the subscriber for payment of your cost sharing, and tell the plan about that arrangement.⁹
  3. It does not reach backwards. An explanation of benefits already sent cannot be recalled. Set this up before the first appointment, not after the first claim.

Do this: do not rely on the automatic rule alone. Call the member number on the card and say, "I am requesting confidential communications under Civil Code section 56.107" — give the address, email and phone you want used, and ask for written confirmation with a date on it. If you are on an insurance-company policy rather than an HMO, the same request runs under Insurance Code section 791.29. If an HMO stalls past the deadline or asks you to justify the request, the DMHC Help Center takes that complaint at 888-466-2219; for an insurance-company policy, complain to the California Department of Insurance instead. How to file one →

Sources

  1. Civil Code §56.107(a)(3): a health care service plan "shall direct all communications regarding a protected individual's receipt of sensitive services directly to the protected individual receiving care"; §56.107(a)(3)(C)(i)–(vii) lists bills and attempts to collect payment, notices of adverse benefit determination, "[a]n explanation of benefits notice," requests for additional information, notices of contested claims, "[t]he name and address of a provider, description of services provided, and other information related to a visit," and any communication containing protected health information — leginfo.legislature.ca.gov. Repealed and re-added by AB 1184 (Stats. 2021, Ch. 190), operative 1 July 2022 (§56.107(f)). "Sensitive services" is defined at Civil Code §56.05(s) as "all health care services related to mental or behavioral health, sexual and reproductive health, sexually transmitted infections, substance use disorder, gender-affirming care, and intimate partner violence, and includes services described in Section 6924, 6925, 6926, 6927, 6928, 6929, and 6930 of the Family Code, and Section 121020 and 124260 of the Health and Safety Code, obtained by a patient at or above the minimum age specified for consenting to the service specified in the section." The parallel provisions for insurance-company policies are Insurance Code §791.29(a)(3) and §791.02(ac).
  2. Civil Code §56.107(a)(4) — no disclosure to "the policyholder, primary subscriber, or any plan enrollees other than the protected individual receiving care, absent an express written authorization of the protected individual receiving care"; Insurance Code §791.29(a)(4) is the parallel ("to the policyholder or any insureds other than the protected individual receiving care").
  3. Civil Code §56.107(a)(3)(B): "If the protected individual has not designated an alternative mailing address, email address, or telephone number pursuant to subdivision (b), the health care service plan shall send or make all communications related to the protected individual's receipt of sensitive services in the name of the protected individual at the address or telephone number on file." Insurance Code §791.29(a)(3)(B) is identical apart from "health insurer" for "health care service plan." This is the sentence most consumer guidance on the subject leaves out.
  4. Civil Code §56.107(b)(1)–(5); Insurance Code §791.29(b)(1)–(5), which adds requests submitted through the insurer's website to the 7-day category. Both require accommodation "in the form and format requested by the individual, if it is readily producible in the requested form and format, or at alternative locations." Department of Managed Health Care All Plan Letter 22-010 (OPL), 17 March 2022, restates the deadlines for plans — dmhc.ca.gov.
  5. Insurance Code §791.29(f) — the Insurance Commissioner "may… assess a civil penalty not to exceed five thousand dollars ($5,000) for each violation, or, if a violation was willful… ten thousand dollars ($10,000)." Civil Code §56.107 carries no parallel penalty provision.
  6. Civil Code §56.05(o): "'Protected individual' means any adult covered by the subscriber's health care service plan or a minor who can consent to a health care service without the consent of a parent or legal guardian, pursuant to state or federal law. 'Protected individual' does not include an individual that lacks the capacity to give informed consent for health care pursuant to Section 813 of the Probate Code" — leginfo.legislature.ca.gov. Insurance Code §791.02(ab) is the parallel definition. The minor-consent statutes are Family Code §6924(b) and Health & Safety Code §124260(b)(1).
  7. Civil Code §56.107(a)(1) and (e); Insurance Code §791.29(a)(1) and (e).
  8. 45 C.F.R. §164.522(b)(2)(iv), which permits a health plan — unlike a provider — to require that a confidential-communication request contain a statement that disclosure could endanger the individual — ecfr.gov. We have not verified whether any California authority reaches self-funded ERISA plans on this point, and this page does not claim it does.
  9. Civil Code §56.107(d); Insurance Code §791.29(d). Note the opening words, "Notwithstanding subdivision (b)" — the carve-out is written against the request mechanism, not against the automatic routing duty.
  10. Kaiser Family Foundation, 2024 Employer Health Benefits Survey, Section 10: "Sixty-three percent of covered workers… are enrolled in plans that are self-funded" — kff.org.

All sections read on the operative text on 18 August 2026. This page describes the statute; it is not legal advice.

In crisis? Call or text 988 — free, 24/7.